A race condition within the Linux kernel batman-adv component could allow an unauthenticated attacker on the local network to trigger CRC corruption, leading to a denial of service.

This is a race condition (CWE-362) occurring in the batadv_bla_add_claim function of the batman-adv module. An unauthenticated attacker can exploit this via crafted CLAIM frames to cause internal state inconsistencies, specifically resulting in CRC corruption and potential system instability.

The vulnerability carries a CVSS score of 7.1, reflecting a high risk of service disruption. Successful exploitation allows for a denial of service condition, which could impact the availability of network services reliant on the batman-adv mesh routing protocol. While the impact is localized to the affected network segment, the resulting instability could lead to significant operational downtime for affected infrastructure.

Immediate Action: Update the Linux kernel to version 5.10.270, 5.15.221, 6.1.188, 6.6.157, or the latest stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel panics or repeated instability within the batman-adv networking module.

Compensating Controls: Restrict access to the local network segment to trusted entities only, as the vulnerability requires adjacency to the network to inject malicious CLAIM frames.

Public Exploit Available: Unknown.

The severity of this vulnerability necessitates prompt attention, particularly for environments relying on batman-adv for mesh networking. Administrators should prioritize patching the kernel to the versions specified above to eliminate the race condition. Failure to update may leave network infrastructure vulnerable to denial of service attacks originating from the local network segment.